Posted
by
Soulskillon Monday March 18, 2013 @01:25PM
from the looked-at-a-poster-and-told-somebody-about-it dept.

In 2010, querying a public AT&T database yielded over 114,000 email address for iPad owners who were subscribed to the carrier. One of the people who found these emails, Andrew 'weev' Auernheimer, sent them to a news site to publicize AT&T's security flaw. He later ended up in court for his actions. Auernheimer was found guilty, and today he was sentenced to 41 months in prison. 'Following his release from prison, Auernheimer will be subject to three years of supervised release. Auernheimer and co-defendant Daniel Spitler were also ordered to pay $73,000 in restitution to AT&T. (Spitler pled guilty in 2011.) The pre-sentencing report prepared by prosecutors recommended four years in federal prison for Auernheimer.' A journalist watching the sentencing said, 'I felt like I was watching a witch trial as prosecutors admitted they didn't understand computers.'

Know I'll get modded down for going against Slashdot groupthink. But what is the argument suggesting? "It all happened on a computer, it shouldn't be prosecuted?" Stealing private information and releasing in publicly isn't just obviously illegal, it caused grief for 114,000 people.

Even if AT&T has a shitty security system, that doesn't make it legal to break in. I'd love to see Slashdot do more mundane crimes. Maybe the home had a sign saying "beware of dog," but the dog was actually at the vet, so the robber was just publicizing a security flaw.

That. It's a flaw that AT&T never would have addressed without public pressure. Further, Mr. Auernheimer did not release private info to the public -- the news agency to which he released the then already-public information is responsible for further publicizing it.

Bottom line: it is ludicrous-speed absurd to prosecute somebody for publicizing already public information. If a newspaper accidentally prints the names and addresses of its entire subscriber base in the classifieds, and I call them to report it, can I then be held accountable for "releasing" the information?

Even with all you said, the penalty for these 'computer crimes'....is WAY off base as far as matching punishment with crime.

We have convicted rapists and murderers that seem to get off with lighter sentences than people that do anything that involves a computer these days, even if the results don't hurt anyone and only embarrass a company or some govt. personnel.

Yes and no, you can trace a rapist to his/her victim, but you can't really assess the damage done by publishing 1k+ email addresses. What if one of those email addresses is an old lady that gets scammed by a nigerian prince? What if it's 100 of those emails that that happens to? Should the guy who provided the means for that to happen even be liable? Could it have happened anyways?

I will say this though, innocent before found guilty, if that was true, then the damage would be 0 as it can't be directly l

Indeed, but I guess it wouldn't make a difference if he just showed how to do it, instead of actively forwarding the addresses.

But what bothers me is not that he's being punished, but the severity of the punishment. 41 months in jail? Please, remind me how many months in jail did the Santander employees responsible for money laundering for terrorists get... oh, wait, I remembered, they didn't even get prosecuted, because rich people can screw everybody freely.

"Think about what you just said for a second... now go make the real posters sandwiches."

You are claiming that Gawker has no responsibility for publishing? According to the official accounts, "Goatse Security" had tried to contact several "more responsible" news outlets to get the story out. They only resorted to including some emails with the story when that failed, in order to verify that it was real.

Never mind their motivations. Yes they acted irresponsibly. But that is as may be. They weren't responsible for first "publishing" emails.

What if one of those email addresses is an old lady that gets scammed by a nigerian prince? What if it's 100 of those emails that that happens to?

If it's that serious then we need to find AT&T criminally negligent for letting absolutely anyone get all those private email address. If it's not that serious after all, then there's no point in railroading the guy who reported the problem, but we can't have it both ways.

"Little punishment"? US justice system is draconian when it comes to punishing crime. These guys are going to have a stigma of "sex offender" for their entire lives on them now.

What the hell happened to rehabilitation? You know, getting both the victim and criminals rehabilitated to be able to live good lives without the spectre of rape hanging over them? Now victim gets "vengeance" which solves absolutely nothing for her, and two guys went from low grade passion criminals to having completely destroyed liv

We have convicted rapists and murderers that seem to get off with lighter sentences than people that do anything that involves a computer these days, even if the results don't hurt anyone and only embarrass a company or some govt. personnel.

Show me the numbers and then we can talk.

Real stats for the rapist and murderer. Real stats for the geek whose computer-related crimes earned him hard time.

In the American federal system, crimes of violence are almost always prosecuted under state law.

Execution List 2012 [deathpenaltyinfo.org] Each state on this list, for example, has executed between 1200 and 1300 death row inmates since 1976.

But he didn't trespass -- he didn't break any laws or even conventions regarding the distinction between public/private property in requesting and being provided this information. If the pile of gold in your unfenced yard was on a conveyor that could be activated from the street, I think you would be hard-pressed to convince anyone that you intended the gold to remain in your yard. Likewise, spewing out customer details in response to a simple sql query to a public-facing DB server, which requires absolutely no circumvention of existing security measures, is difficult to paint as an earnest attempt to make a public/private delineation, and thereby prevent even accidental leakage.

As has already been pointed out, the key charge here is "access[ing] a computer without authorization." Since the publicly-facing DB server was not in any sort of secured or even posted enclave, it can only be presumed that the court finds the mere act of interfacing with this system a crime for no reason other than that AT&T has established the server as "private" after-the-fact. That opens up a terrifying door in that any service provider could suddenly declare you persona non grata retroactively, and bring similar criminal charges against you. While that's certainly a leap, it's not a big one...

. . . say I left a pile of gold in the street, I can't have any expectation it'll be there tomorrow, the streets not mine, but say I left it in my yard, and it's unfenced, to get it, you have to trespass + it's on my property. That's what this guy did, he trespassed and took it . ..

No, he didn't trespass. The owner had a clear understanding with the public that they were allowed in the yard. The man saw a pile of gold in the yard and asked the local robot - which the owner had configured to hand out vari

Well... it would more like a farm... you'd enter my 100 acre farm, drive around and randomly spot exposed gold that I did not intend to expose to you, but forgot to bury yesterday because aunt laura swung by. No signs differentiate the gold's space from any other, but you clearly know you're on my land and you know that gold is valuable. I never argued the street's case, besides that I have no expectation of security around the gold on the street, at&t's network would be a private residence owned by a

Actually, they are both at fault here.
I don't see a huge effort by Andrew to contact AT&T and say "uh, guys, you have a huge problem here".
It's very easy to percieve his actions in a malicious way.
Not that AT&T didn't goof, but this was the wrong way to address it.

Nearly everything Weev does is malicious, but the question is: is it (or should it be) illegal? He was convicted of identity fraud and "conspiracy to access a computer without authorization". Think about that: requesting unprotected publicly-accessible webpages is "access[ing]" a computer without authorization". By that standard, anyone who uses the internet could be convicted of a crime.

Based on the context it was more then just accessing publicly available data. It's not as if he clicked on an link and went "Oh, look, a bunch oh e-mail addresses!". There was effort involved into getting to that list.

That being said, even if he did run into a bunch of e-mail addresses by being in the wrong place at the wrong time.. e-mailing that list to someone and going "OMG LOOK AT THIS" was proof that he knew the seriousness of the list he found. It cannot be argued that he did not know what he was

e-mailing that list to someone and going "OMG LOOK AT THIS" was proof that he knew the seriousness of the list he found. It cannot be argued that he did not know what he was doing.

And if a student finds a gun on school grounds and brings it to the attention of a teacher, that is proof that the student knows the seriousness of that situation. But I fail to see how that justifies throwing the book at the student.

It's not a perfect situation where there's a black-and-white answer. Think about the implications if the court rules PII / contact info about those people is publicly available information. EVERY marketer everywhere would fall all over themselves to get that information and add it to their databases, maybe even package and sell it, because it would have been called "publicly available" by a court of law. Can you imagine how awful that would be? Whereas, now, there is a stigma of 'a guy got hard time for com

Isn't a key element of the legal case that he also retransmitted the private information? He did not merely receive it.

From the court filing [archive.org], it appears both charges are predicated on the notion that sending GET requests to an unprotected, publicly-accessible web server constitute unauthorized access under Title 18, Section 1030(a)(2)(C) [cornell.edu].

Actually the GET request required the ICC-ID of the device to get the email address for that device. The ICC-ID could be construed as a the name of the owner of the device asking for the information and therefore he was fraudulently impersonating someone else when making the requests

Isn't a key element of the legal case that he also retransmitted the private information? He did not merely receive it.

From the court filing [archive.org], it appears both charges are predicated on the notion that sending GET requests to an unprotected, publicly-accessible web server constitute unauthorized access under Title 18, Section 1030(a)(2)(C) [cornell.edu].

Actually, from your own link, the charges were predicated on the notion that spoofing an identity in order to fool someone into giving you confidential information is a crime. These weren't just GET URL requests like your browser is sending to read Slashdot, but requests with spoofed IDs - closer to sending GET requests to Slashdot with spoofed cookie IDs in an attempt to get emails of other Slashdot users.

Or, as an analogy, this would be like calling a phone number and saying "Hi, this is Bill at [Bank of

And would AT&T do anything about it? What about the next security hole? Public embarrassment does a lot more to cause the necessary heads to roll than trying to do AT&T's jobs for them. They were incompetent and irresponsible with customer data and as far as i'm concerned, handing the data to the press was the absolute right call. How else to punish and teach?

I don't see a huge effort by Andrew to contact AT&T and say "uh, guys, you have a huge problem here".

Then you have never tried to contact them about... well, anything.

Not even being snarky, just relating my own experiences; I have to deal with AT&T every day, and getting them to so much as acknowledge a problem on their end, let alone do anything to fix it, is similar to attempting to snorkle to the bottom of the Marianas Trench.

If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.

A better analogy:
A bank has a web server that takes person's name and returns that person's SSN. A "hacker" sends your username and gets your SSN. He does that for several people from the phone directory. Hacker goes to prison for the BANK'S FAULT of exposing SSNs.

A bank has a web server that takes person's name and returns that person's SSN. A "hacker" sends your username and gets your SSN. He does that for several people from the phone directory. Hacker goes to prison for the BANK'S FAULT of exposing SSNs.

It's only the bank's fault for breaching a specific law regarding protection of private information by certain security means (strong authentication, encryption, etc) but if the hacker did anything but flip on his computer (such as construct a program, no matter how small or simple, that specifically talks to the open app on the web server) then he too is guilty of misuse of a computer system under current law.

Debate the efficacy of the law, punishment, etc. all you want, but this is how the current law wor

If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.

Here's a better analogy: you send the bank self-addressed stamped envelopes, and they willingly send private information about their clients back to you in those envelopes.

If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.

Here's a better analogy: you send the bank self-addressed stamped envelopes, and they willingly send private information about their clients back to you in those envelopes.

If those envelopes were in any way a misrepresentation of your legal desire to communicate with your bank (such as an incorrect identity, overstated request, etc) then you, the sender, are guilty of mail fraud. Do not pass go, do not collect $200. The legal system seems to be pretty mysterious to a large part of slashdot...

Not a good analogy, as AT&T didn't lose their database, just exclusivity of it (i.e. now everyone else also has it). A better meatspace analogy might be if a store employee left open a door to an office, and someone walking by took pictures of next weeks sale items (which stores typically don't want released early) and sent that info to a newspaper. The store has not lost any items, just the info about them.

He did ask before they gave it to him though. It wasn't thrown at him unrequested.However, money is an unneccessary ingredient here - all he got was information. The only people who will give an analogy involving money are those who want to equate what he did with stealing. But that is nothing but misleading sophistry.

He went up to the reception desk and said "can I have the name and address of client 1000000000 please?" which they then gave him. He then said "and for client 1000000001 please?" which then t

First off, the whole reason these guys got whacked by the judge is because they did the standard script-kid thing and went onto IRC and boasted about it, and talk about how they were going to take down AT&T, and make a name for their security company ( Goatse Security, obvious play on goat sex troll )

He didn't "break in". He sent requests to a publicly-accessible web server, and AT&T sent back private information. This wasn't hacking, or even a DOS attack. AT&T is at fault here.

By that rationale, any request on a web server via the HTTP GET or POST that could escalate privilege or divulge private data should go unpunished. You realize the number of vulnerabilities accessible via a well crafted GET URL? XSS, SQL Injection, tons of stuff. Ignore the fact HTTP is even involved here. This is no different than finding a weakness at any other level of the OSI model, the fact people can easily understand HTTP GET's doesn't make them any less serious and dangerous to an attacker.

Honestly, this has been argued over the Ping of Death back in the day. I mean, your simply sending an ICMP packet via a ping command, it's not like your hacking.

In the end it's about context. Exploiting a weakness is by definition hacking. Just because the hack isn't enigmatic, doesn't mean it's not a hack. Look at Jon Draper and a plastic whistle that happened to hit 2600hz easily.

"But it's just a guy blowing a whistle into a phone, it's not hacking".

These guys crafted a specific HTTP GET request that returned private data. The key in this request was generated by them based off a known flaw in ATT's systems (using ICC-ID as a semi private key). Then they shared that data with a news organization.

Sure, those of us in the industry can shake our head at how stupid AT&T was, but at the same time most of us recognize the line these two guys crossed. It's one thing to send an e-mail to AT&T and copy a security mailing list with a simple example, it's another to write a program and automate the extraction of over 120k e-mails and then package the data and send it to Gawker, while boasting about it on IRC channels.

Auernheimer likened his actions to walking down the street and writing down the physical addresses of buildings, only to be charged with identity theft.

I could make the same argument for randomly trying passwords against accounts. "I'm just checking to see if this key happens to work in this door...."

He didn't "break in". He sent requests to a publicly-accessible web server, and AT&T sent back private information. This wasn't hacking, or even a DOS attack. AT&T is at fault here.

He wasn't just looking to get to his att.com home page and happened upon a list of email addresses. Getting at those addresses took some deliberate work on his part (a big part of the law is not so much about perceptions of ease/publicity, but in perceptions of *intent*). If you leave your windowshades open a little at home, and someone comes along outside and peeps inside to watch you doing [insert something from imagination here] it is the "peeper" who is committing a crime, not the "peep-ee". In this c

There are laws against what AT&T did in the UK (if you're storing information about a person that's sufficient to identify that person, you can't make it public without their permission, although you can obtain their permission when you obtain the information). Ones that are considered important enough to be taught in schools.

As someone else pointed out, all he did was request data from a public server and AT&T sent it to him. Also, he got 41 months for forwarding 114,000 email addresses to news site, which is overkill. Had he physically broke into an AT&T office and took the email addresses from someone's desk, he would have received less prison time.

He should have been given community service at the most, and then got an award for exposing a flaw from AT&T.

The Principle of "Full Disclosure" -- Meaning, companies often don't fix vulnerabilities in a timely fashion until the risk is exposed by making the vulnerability public. This principle has been important in the history of and current landscape of information security, and many people think its effects have been a net benefit.

Harm -- how were these people exactly harmed by having their email addresses revealed? If someone posted my email and iPad MAC on a web site, woul

Know I'll get modded down for going against Slashdot groupthink. But what is the argument suggesting? "It all happened on a computer, it shouldn't be prosecuted?" Stealing private information and releasing in publicly isn't just obviously illegal, it caused grief for 114,000 people.

He didn't release it publicly. He released it to a news site (which did the responsible thing).

The crime wasn't breaking in (as this has been repeated over and over again), it was disclosure.

Part of the problem is that the prosecutors are simply ignorant as to what they are prosecuting. So any "evidence" presented was done without understanding of what they were asserting. That's quite disturbing on its own.

The "offense" isn't necessarily hacking, because that is not what happened (though it is 'believed' to have happened). What he did was collect the information and present it to the media to bri

Your doctor tells you your medical records will be posted in the front window of a white house at 123 Main St. You notice that the street is full of white houses. Just out of curiosity, you go to 125 Main St and see someone else's medical records. 121 Main St., the same thing. In fact every house on the block has a different person's medical records. You see a bunch of other people on the street, going to get their medical records from their respective houses. You joke out loud that you could make a lot of money selling everyone's medical records to some guy in the Ukraine. You tell the hospital that this is a lousy way to communicate medical records.

You get 41 months in prison for viewing everyone's medical records (in plain view) and for your "intent" to sell them to some guy in the Ukraine.

I suppose the prosecutors figured out that Auernheimer managed to lay his hands on over 100,000 email addresses that iPad owners had used to register their devices. So not random email addresses, but email addresses that were in actual use, and with some rather significant personal information attached.

So what exactly do they need to understand about computers beyond that?

That the defendant did not "break in". He did not circumvent any system or other contrivance designed to secure sensitive information. Those systems and contrivances simply did not exist. The worst that can be said of what he did was that he was irresponsible in sending the clearly sensitive information to someone else. The right thing to do, of course, would have been to contact AT&T. Had he done that, there wouldn't even be a case for restitution, unless maybe it was to compensate the defendant for doing the work that AT&T failed to do.

I never said he did "break in". But clearly he copied 114,000 email addresses that he shouldn't have copied. As a "journalist" (that's what the article says; I doubt it) did _not_ say: "I felt like I was watching a trial with a defendant who admitted he doesn't understand the law". Or common decent behaviour. Or the fact that just because you figure out how to do something, doing it might still not be a good idea.

The purported target, AT&T, is hardly the nicest organization, but the actually affected people were just regular people. This doesn't seem especially out of line with the USA's normal unhealthy sentencing. We want to punish, not correct, those convicted here.

As long as that attitude remains dominant, miscarriages of justice will occur within every branch of justice(except for the super-rich).

Their response to the other is "Oh my god, if they can webscrape publicly accessible information, the next thing these vial social outcasts will be doing is hax0ring into NORAD and launching nuclear warheads and initiating WWIII and I can't have that because I haven't finished watching Real Housewives, yet!"

The Steubenville convictees are legally juveniles. Society has decided that we don't throw the book at them. Had they been adults, they would not be getting sent to a juvenile facility, and they would not be getting out in so short a time. It's hardly an apt comparison.

It's all about who the victim and the perpetrator of the crime is: In the Steubenville case, the victim is a powerless teenage girl, and the perps are a couple of somewhat powerful (at least locally, where the high school football team is a privileged class) teenage boys. In this case, the victim is AT&T (the largest campaign donor in the US), and the perp is a relatively powerless computer geek.

This is just a subset of the more extreme differences: Rob $2000 from a bank, and if you're lucky you won't be shot by the police. Rob $2 billion from a bank, and the SEC or OCC will settle with you for $500 M (25% of your take) and no admission of wrongdoing.

And no, that's not the way it's supposed to work, but it's the way it's actually working.

Two young men in steubenville rape a young women and get 1 - 2 years in jail. A man writes a script to get email address from a website and gets 3.5 years in jail. Something's not right.

You have a point in that "computer crimes" are often subject to penalties that are far overkill because the legal system has few people, both lawyers and judges, who understand technology well. However, the rape case got the verdict it did for a variety of reasons.
1) The young woman wasn't actually "raped" in terms of nobody put his penis inside her, but some idiot young men fingered her and photographed it.
2) She was so drunk that she had no idea what happened. It was the photos that made this even

This people do not have any understanding of computers or the internet in general. I doubt it is going to change in the future. Since this type of people are generally not computer literature at all and never have been.

Are IP addresses or hard drives relevant here? Sometimes, you don't need to understand every facet of a subject, even the the most common terms, to understand a specific case like this. All they need to understand is how a webserver works, which can be explained satisfactorily in a few minutes. Of course, it seems they neglected to take those few minutes.

the ATT servers were not secured. the data was figurately lying out on the street, in the old days there would be a black or brown binder holding a galloping shitload of greenbar paper, and if you flipped the binder open, it would say, "LIST OF iPHONE USERS DATA." that is thus insecure data, hence public. ATT's trash blowing across the street. the guy should not have been prosecuted, he should have been given a code for free wi-fi at McDonalds for two weeks.

A naked woman standing in the street doesn't mean you suddenly have the right to sexually assault her, or does that sound like its okay in your mind as well?

And lets be clear. Data doesn't give a fuck, so stop that bullshit.

And to be more clear: He took distinct actions to access data. Applying reverse engineering and some packet sniffing he SEARCHED FOR AND FOUND the data in question. It wasn't linked from any normally accessible location or anything el

In 2010, querying a public AT&T database yielded over 114,000 email address for iPad owners who were subscribed to the carrier.

If the database was publicly-accessible, how is it a criminal act, as a member of said "public", to actually access it? That's like a newspaper that accidentally publishes data it considers private and prosecuting readers.

The criminal act was negligence by AT&T. This is simply a distraction and face-saving prosecution to wash AT&T clean of culpability.

If the database was publicly-accessible, how is it a criminal act, as a member of said "public", to actually access it? That's like a newspaper that accidentally publishes data it considers private and prosecuting readers.

It wasn't publicly accessible. The information of _one_ iPad owner was accessible to that _one_ iPad owner. He figured out how to make his computer pretend to be many different iPads.

There was some interesting discussion recently about anti-hacking laws were huge problems were caused by the fact that the law makes "exceeding authorized access" a crime, which can then be used to apply in all kinds of situations that actually don't have to do anything with hacking. This one is the opposite: The guy didn't

Many conflicting articles have been released concerning when the flaw was disclosed to whom. IANAL, but I *think* this may have been the crux of the prosecution's case. If the flaw was disclosed to others before AT&T or perhaps the people whose emails were discovered = crime. If not = no crime.

I am not advocating this position as correct. Just trying to present an opinion.

One of the better articles on the subject of disclosure, still leaves many murky grey area problems for any professional security

Applicants could peek ahead at the status of their admissions by adding a few numbers to their URLs on the site. Harvard rejected all of the people who tried the hack. And told other ivy b-schools about them too who also rejected them.

They would only be fined 1 days worth of profits...Corporations are people too? Bullshit. Corporations are treated better than people, under the law. I seriously suggest that every individual incorporate themselves and, when accused of any wrongdoing, claim it was via the corporation, and suggest that the law take it up with the board of directors.

The same type of reckless design that went into AT&T's website for registration is symptomatic of the direction the industry has been heading. It represents that YOUR PRIVACY in the hands of a monopoly is not worth two-shits to them. Even if it was "only an email address" it could have easily been your SSN# on a CD, or medical record on an unencrypted laptop, voting record or ballot on a voting machine, whatever. Weev sounds like a jackass, but I would have expected better security from AT&T. If you're going to take the place to be a reactionary "victim" then maybe you should ask yourself who victimized you first -- AT&T perhaps? If AT&T left your car unlocked, would you still blame the thief?

Those rocks are for you to look at, not to step on my property and start turning over. Of course, once the cost becomes negligible for a robot to do the rock turning for you, then I'm sure we'll have a rash of home break ins committed by key wielding robots.

If you find my key under a rock in my backyard, it is still theft if you break into my house with it and steal things.

The analogy is not really applicable. This is more like writing all your secrets into a notebook and putting it into a library (in a section accessible to everyone). Then you sue the person who found the notebook.

Leaving the data open to any web request is the true crime here. I do not know about the US, but in Europe that would have been a violation against the Data Protection Act.

No. If you owned an automobile dealership, and wrote down the names and addresses of every customer on a poster, and I asked you for a copy of the poster, and you gave it to me, and then had me prosecuted for displaying the poster, that's the analogy you should be considering here.

Except it was if you were asking for the poster as if you were someone who was supposed to have access to the poster. He was impersonating a person (or machine in this case). He didn't visit att.com and it spewed 100k email addresses at him. He did some traffic sniffing and reverse engineering.

That's not what happened at all. If you must have a key analogy, here's what happened.

You gave your key to a company for safekeeping. He walked up to the company and asked for your key. They gave it to him. He, in turn, gave it to a news company to point out how flawed the "security" was of the company you gave your key to.

If you find my key under a rock in my backyard, it is still theft if you break into my house with it and steal things.

But if i hand you a camera, you go and take pictures of all your credit cards and hand the camera back to me, is that a crime?Lets be real here. There was no house, there wasn't a door, there was no security at all. There was no theft, no loss of property. Just a company caught with it's pants down giving out it's customer's sensitive information. Sure, you had to know where to go to get

Try again. If I send you a letter asking for you to send me your key and you send it that is either your own fault or the house keeper's fault (AT&T in this case). You/AT&T have the ability to not send the key. If this was a buffer overflow or some injection attack you might have a point but that is not the case in this instance.